search

allinurl / goaccess

GoAccess is a real-time web log analyzer and interactive viewer that runs in a terminal in *nix systems or through your browser.
https://goaccess.io
MIT License
18.47k stars 1.11k forks source link

How can I pass custom nginx log format to GoAccess #2721

Open erencanss opened 1 month ago

erencanss commented 1 month ago

My sample logs are here. Could you help me?

83.99.151.67 - - [19/Sep/2024:06:25:03 +0300] GET /brillant-akilli-tul-perde-bebeksi-mavi-renkli-tul-dikey-zebra-perde-duz-1-kalite/67970.html HTTP/1.1 "200" 72151 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GeedoProductSearch; +http://www.geedo.com/product-search.html) Chrome/79.0.3945.88 Safari/537.36" "www.eperde.com to: 192.168.100.99:80" rt="0.489" uct="0.000" uht="0.492" urt="0.492"

0bi-w6n-K3nobi commented 1 month ago

Hi @erencanss ...

Do you can try:

LANG="en_US.UTF-8" LC_TIME="en_US.UTF-8"  \
  goaccess LOGFILE  \
    --log-format='%h %^[%x] %m %U %H "%s" %b "%R" "%u" "%v %^" rt="%T" utc="%^" uht="%^" urt="%^"'  \
    --datetime-format='%d/%b/%Y:%H:%M:%S %z'  \
    --output REPORT.html

or into goaccess.conf (without quotes) : 

log-format %h %^[%x] %m %U %H "%s" %b "%R" "%u" "%v %^" rt="%T" utc="%^" uht="%^" urt="%^"
datetime-format '%d/%b/%Y:%H:%M:%S %z

Well... You need choice what those values between rt, utc, uht or urt that will be show. I choiced rt is more coherent, but if you what another just exchange "%T" with new field.

erencanss commented 1 month ago

Hi @erencanss ...

Do you can try:

LANG="en_US.UTF-8" LC_TIME="en_US.UTF-8"  \
  goaccess LOGFILE  \
    --log-format='%h %^[%x] %m %U %H "%s" %b "%R" "%u" "%v %^" rt="%T" utc="%^" uht="%^" urt="%^"'  \
    --datetime-format='%d/%b/%Y:%H:%M:%S %z'  \
    --output REPORT.html

or into goaccess.conf (without quotes) :

log-format %h %^[%x] %m %U %H "%s" %b "%R" "%u" "%v %^" rt="%T" utc="%^" uht="%^" urt="%^"
datetime-format '%d/%b/%Y:%H:%M:%S %z

Well... You need choice what those values between rt, utc, uht or urt that will be show. I choiced rt is more coherent, but if you what another just exchange "%T" with new field.

It works. Thank you for your help.